Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit 11567c4

Browse files
Merge pull request #169 from python-security/no_more_uimode
Remove --trim option and UImode Enum
2 parents 3fc8046 + 12619b7 commit 11567c4

File tree

10 files changed

+104
-175
lines changed

10 files changed

+104
-175
lines changed

‎README.rst

Lines changed: 29 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -86,53 +86,56 @@ Usage
8686
.. code-block::
8787
8888
usage: python -m pyt [-h] [-a ADAPTOR] [-pr PROJECT_ROOT]
89-
[-b BASELINE_JSON_FILE] [-j] [-m BLACKBOX_MAPPING_FILE]
90-
[-t TRIGGER_WORD_FILE] [-o OUTPUT_FILE] [--ignore-nosec]
91-
[-r] [-x EXCLUDED_PATHS] [-trim] [-i]
92-
targets [targets ...]
89+
[-b BASELINE_JSON_FILE] [-j] [-t TRIGGER_WORD_FILE]
90+
[-m BLACKBOX_MAPPING_FILE] [-i] [-o OUTPUT_FILE]
91+
[--ignore-nosec] [-r] [-x EXCLUDED_PATHS]
92+
[--dont-prepend-root] [--no-local-imports]
93+
targets [targets ...]
9394
9495
required arguments:
95-
targets source file(s) or directory(s) to be tested
96+
targets source file(s) or directory(s) to be scanned
9697
9798
important optional arguments:
9899
-a ADAPTOR, --adaptor ADAPTOR
99-
Choose a web framework adaptor: Flask(Default),
100-
Django, Every or Pylons
101-
100+
Choose a web framework adaptor: Flask(Default),
101+
Django, Every or Pylons
102+
102103
-t TRIGGER_WORD_FILE, --trigger-word-file TRIGGER_WORD_FILE
103-
Input file with a list of sources and sinks
104-
104+
Input file with a list of sources and sinks
105+
105106
-m BLACKBOX_MAPPING_FILE, --blackbox-mapping-file BLACKBOX_MAPPING_FILE
106-
Input blackbox mapping file
107+
Input blackbox mapping file
107108
108109
optional arguments:
109110
-pr PROJECT_ROOT, --project-root PROJECT_ROOT
110-
Add project root, only important when the entry file
111-
is not at the root of the project
111+
Add project root, only important when the entry file
112+
is not at the root of the project.
112113
113114
-b BASELINE_JSON_FILE, --baseline BASELINE_JSON_FILE
114-
Path of a baseline report to compare against (only
115-
JSON-formatted files are accepted)
115+
Path of a baseline report to compare against (only
116+
JSON-formatted files are accepted)
117+
118+
-j, --json Prints JSON instead of report.
116119
117-
-j, --json Prints JSON instead of report
120+
-i, --interactive Will ask you about each blackbox function call in
121+
vulnerability chains.
118122
119123
-o OUTPUT_FILE, --output OUTPUT_FILE
120-
Write report to filename
124+
Write report to filename
121125
122-
--ignore-nosec Do not skip lines with # nosec comments
126+
--ignore-nosec Do not skip lines with # nosec comments
123127
124-
-r, --recursive Find and process files in subdirectories
128+
-r, --recursive Find and process files in subdirectories
125129
126130
-x EXCLUDED_PATHS, --exclude EXCLUDED_PATHS
127-
Separate files with commas
131+
Separate files with commas
128132
133+
--dont-prepend-root In project root e.g. /app, imports are not prepended
134+
with app.*
129135
130-
print arguments:
131-
-trim, --trim-reassigned-in
132-
Trims the reassigned list to just the vulnerability
133-
chain.
134-
-i, --interactive Will ask you about each blackbox function call in
135-
vulnerability chains.
136+
--no-local-imports If set, absolute imports must be relative to the
137+
project root. If not set, modules in the same
138+
directory can be imported just by their names.
136139
137140
Usage from Source
138141
=================

‎pyt/__main__.py

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,7 @@
1919
from .usage import parse_args
2020
from .vulnerabilities import (
2121
find_vulnerabilities,
22-
get_vulnerabilities_not_in_baseline,
23-
UImode
22+
get_vulnerabilities_not_in_baseline
2423
)
2524
from .vulnerabilities.vulnerability_helper import SanitisedVulnerability
2625
from .web_frameworks import (
@@ -65,10 +64,6 @@ def retrieve_nosec_lines(
6564
def main(command_line_args=sys.argv[1:]): # noqa: C901
6665
args = parse_args(command_line_args)
6766

68-
ui_mode = UImode.TRIM
69-
if args.interactive:
70-
ui_mode = UImode.INTERACTIVE
71-
7267
files = discover_files(
7368
args.targets,
7469
args.excluded_paths,
@@ -123,9 +118,9 @@ def main(command_line_args=sys.argv[1:]): # noqa: C901
123118
analyse(cfg_list)
124119
vulnerabilities = find_vulnerabilities(
125120
cfg_list,
126-
ui_mode,
127121
args.blackbox_mapping_file,
128122
args.trigger_word_file,
123+
args.interactive,
129124
nosec_lines
130125
)
131126

@@ -140,7 +135,10 @@ def main(command_line_args=sys.argv[1:]): # noqa: C901
140135
else:
141136
text.report(vulnerabilities, args.output_file)
142137

143-
has_unsanitized_vulnerabilities = any(not isinstance(v, SanitisedVulnerability) for v in vulnerabilities)
138+
has_unsanitized_vulnerabilities = any(
139+
not isinstance(v, SanitisedVulnerability)
140+
for v in vulnerabilities
141+
)
144142
if has_unsanitized_vulnerabilities:
145143
sys.exit(1)
146144

‎pyt/cfg/stmt_visitor.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -665,6 +665,7 @@ def add_blackbox_or_builtin_call(self, node, blackbox): # noqa: C901
665665
call_node.label = LHS + " = " + RHS
666666

667667
call_node.right_hand_side_variables = rhs_vars
668+
# Used in get_sink_args
668669
rhs_visitor = RHSVisitor()
669670
rhs_visitor.visit(node)
670671
call_node.args = rhs_visitor.result

‎pyt/usage.py

Lines changed: 24 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,9 @@
2020
def _add_required_group(parser):
2121
required_group = parser.add_argument_group('required arguments')
2222
required_group.add_argument(
23-
'targets', metavar='targets', type=str, nargs='+',
24-
help='source file(s) or directory(s) to be tested'
23+
'targets', metavar='targets', nargs='+',
24+
help='source file(s) or directory(s) to be scanned',
25+
type=str
2526
)
2627

2728

@@ -54,21 +55,27 @@ def _add_optional_group(parser):
5455
action='store_true',
5556
default=False
5657
)
58+
optional_group.add_argument(
59+
'-t', '--trigger-word-file',
60+
help='Input file with a list of sources and sinks',
61+
type=str,
62+
default=default_trigger_word_file
63+
)
5764
optional_group.add_argument(
5865
'-m', '--blackbox-mapping-file',
5966
help='Input blackbox mapping file.',
6067
type=str,
6168
default=default_blackbox_mapping_file
6269
)
6370
optional_group.add_argument(
64-
'-t', '--trigger-word-file',
65-
help='Input file with a list of sources and sinks',
66-
type=str,
67-
default=default_trigger_word_file
71+
'-i', '--interactive',
72+
help='Will ask you about each blackbox function call in vulnerability chains.',
73+
action='store_true',
74+
default=False
6875
)
6976
optional_group.add_argument(
7077
'-o', '--output',
71-
help='write report to filename',
78+
help='Write report to filename',
7279
dest='output_file',
7380
action='store',
7481
type=argparse.FileType('w'),
@@ -78,11 +85,13 @@ def _add_optional_group(parser):
7885
'--ignore-nosec',
7986
dest='ignore_nosec',
8087
action='store_true',
81-
help='do not skip lines with # nosec comments'
88+
help='Do not skip lines with # nosec comments'
8289
)
8390
optional_group.add_argument(
84-
'-r', '--recursive', dest='recursive',
85-
action='store_true', help='find and process files in subdirectories'
91+
'-r', '--recursive',
92+
dest='recursive',
93+
action='store_true',
94+
help='Find and process files in subdirectories'
8695
)
8796
optional_group.add_argument(
8897
'-x', '--exclude',
@@ -108,39 +117,18 @@ def _add_optional_group(parser):
108117
)
109118

110119

111-
def _add_print_group(parser):
112-
print_group = parser.add_argument_group('print arguments')
113-
print_group.add_argument(
114-
'-trim', '--trim-reassigned-in',
115-
help='Trims the reassigned list to just the vulnerability chain.',
116-
action='store_true',
117-
default=True
118-
)
119-
print_group.add_argument(
120-
'-i', '--interactive',
121-
help='Will ask you about each blackbox function call in vulnerability chains.',
122-
action='store_true',
123-
default=False
124-
)
125-
126-
127-
def _check_required_and_mutually_exclusive_args(parser, args):
128-
if args.targets is None:
129-
parser.error('The targets argument is required')
130-
131-
132120
def parse_args(args):
133121
if len(args) == 0:
134122
args.append('-h')
135123
parser = argparse.ArgumentParser(prog='python -m pyt')
124+
125+
# Hack to in order to list required args above optional
136126
parser._action_groups.pop()
127+
137128
_add_required_group(parser)
138129
_add_optional_group(parser)
139-
_add_print_group(parser)
140130

141131
args = parser.parse_args(args)
142-
_check_required_and_mutually_exclusive_args(
143-
parser,
144-
args
145-
)
132+
if args.targets is None:
133+
parser.error('The targets argument is required')
146134
return args

‎pyt/vulnerabilities/__init__.py

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,8 @@
11
from .vulnerabilities import find_vulnerabilities
2-
from .vulnerability_helper import (
3-
get_vulnerabilities_not_in_baseline,
4-
UImode
5-
)
2+
from .vulnerability_helper import get_vulnerabilities_not_in_baseline
63

74

85
__all__ = [
96
'find_vulnerabilities',
10-
'get_vulnerabilities_not_in_baseline',
11-
'UImode'
7+
'get_vulnerabilities_not_in_baseline'
128
]

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /